Skip to content
This repository was archived by the owner on Jul 11, 2023. It is now read-only.

Commit 0b468b2

Browse files
MagicloudMagicloud
committed
New example: Confluence
The example runs Confluence Docker image in a single node ASG, with a RDS, and two ALBs (internal and external). The ALBs have domain names set, and TLS cert (from ACM).
1 parent 614ecfd commit 0b468b2

File tree

3 files changed

+322
-0
lines changed

3 files changed

+322
-0
lines changed

‎examples/confluence/README.md

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Confluence
2+
3+
Showing pratical usage of a fully functional website, from HTTPS frontend to Postgres backend.

‎examples/confluence/docker-compose.tpl

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
version: "3.7"
2+
services:
3+
confluence:
4+
image: atlassian/confluence-server
5+
ports:
6+
- "${http_port}:8090"
7+
volumes:
8+
- /data/confluence:/var/atlassian/application-data/confluence
9+
environment:
10+
- ATL_JDBC_URL=jdbc:postgresql://${db_host}:5432/${db_db}
11+
- ATL_JDBC_USER=${db_user}
12+
- ATL_JDBC_PASSWORD='${db_pass}'
13+
- ATL_DB_TYPE=postgresql

‎examples/confluence/main.tf

+306
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,306 @@
1+
variable "region" {
2+
type = string
3+
description = "AWS region to run the example"
4+
}
5+
variable "ssh_key" {
6+
type = string
7+
description = "AWS SSH key name for instance"
8+
}
9+
variable "db_password" {
10+
type = string
11+
description = "Password for RDS"
12+
}
13+
variable "base_domain" {
14+
type = string
15+
description = "Base domain name for internal and external FQDN, with the last dot"
16+
}
17+
18+
data "aws_availability_zones" "azs" {}
19+
20+
data "aws_route53_zone" "sandbox" {
21+
name = var.base_domain
22+
private_zone = false
23+
}
24+
25+
module "vpc" {
26+
source = "fpco/foundation/aws//modules/vpc-scenario-2"
27+
azs = data.aws_availability_zones.azs.names
28+
cidr = "192.168.0.0/16"
29+
name_prefix = "confluence"
30+
private_subnet_cidrs = ["192.168.100.0/24", "192.168.101.0/24"]
31+
public_subnet_cidrs = ["192.168.0.0/24", "192.168.1.0/24"]
32+
region = var.region
33+
}
34+
35+
module "centos" {
36+
source = "fpco/foundation/aws//modules/ami-centos"
37+
release = "7"
38+
}
39+
40+
module "asg-sg" {
41+
source = "fpco/foundation/aws//modules/security-group-base"
42+
name = "asg-sg"
43+
description = "SG for ASG"
44+
vpc_id = module.vpc.vpc_id
45+
}
46+
47+
module "asg-to-world" {
48+
source = "fpco/foundation/aws//modules/open-egress-sg"
49+
security_group_id = module.asg-sg.id
50+
}
51+
52+
module "ssh-port-sg-rule" {
53+
source = "fpco/foundation/aws//modules/single-port-sg"
54+
security_group_id = module.asg-sg.id
55+
cidr_blocks = ["0.0.0.0/0"]
56+
port = 22
57+
description = "SSH from anywhere, for debug."
58+
}
59+
60+
resource "aws_security_group_rule" "asg_int_alb_http_port_sg_rule" {
61+
security_group_id = module.asg-sg.id
62+
from_port = 80
63+
to_port = 80
64+
type = "ingress"
65+
protocol = "TCP"
66+
description = "HTTP ingress for int ALB"
67+
source_security_group_id = module.int-alb.security_group_id
68+
}
69+
70+
resource "aws_security_group_rule" "asg_ext_alb_http_port_sg_rule" {
71+
security_group_id = module.asg-sg.id
72+
from_port = 80
73+
to_port = 80
74+
type = "ingress"
75+
protocol = "TCP"
76+
description = "HTTP ingress for ext ALB"
77+
source_security_group_id = module.ext-alb.security_group_id
78+
}
79+
80+
module "asg" {
81+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/single-node-asg?ref=lb-asg"
82+
ami = module.centos.id
83+
instance_type = "m5.xlarge"
84+
key_name = var.ssh_key
85+
name_prefix = "confluence"
86+
name_suffix = ""
87+
region = var.region
88+
security_group_ids = [module.asg-sg.id]
89+
subnet_id = module.vpc.private_subnet_ids[0]
90+
public_ip = false
91+
alb_target_group_arns = [module.int-forwarder.target_group_arn, module.ext-forwarder.target_group_arn]
92+
data_volume_size = 50
93+
init_prefix = <<EOF
94+
yum install -y python3-pip
95+
pip3 install awscli
96+
${module.install-docker-compose.init_snippet}
97+
EOF
98+
init_suffix = <<EOF
99+
mkdir -p /data
100+
mkfs.xfs /dev/xvdf
101+
mount /dev/xvdf /data
102+
mkdir -p /data/confluence
103+
cat > /tmp/docker-compose.yml <<EOCAT
104+
${data.template_file.docker_compose.rendered}
105+
EOCAT
106+
cd /tmp
107+
docker-compose up -d
108+
# rm docker-compose.yml
109+
EOF
110+
}
111+
112+
data "template_file" "docker_compose" {
113+
template = file("${path.module}/docker-compose.tpl")
114+
vars = {
115+
http_port = 80
116+
db_host = module.rds.endpoint
117+
db_db = "confluence"
118+
db_user = "confluence"
119+
db_pass = var.db_password
120+
}
121+
}
122+
123+
module "data-backup" {
124+
source = "fpco/foundation/aws//modules/dlm-lifecycle-policy"
125+
name_prefix = "confluence"
126+
role_name = module.asg.asg_iam_role_name
127+
ebs_target_tags = { Name = module.asg.data_volume_name_tag }
128+
}
129+
130+
module "install-docker-compose" {
131+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/init-snippet-install-docker-yum?ref=install-docker"
132+
}
133+
134+
module "rds-sg" {
135+
source = "fpco/foundation/aws//modules/security-group-base"
136+
name = "rds-sg"
137+
description = "SG for RDS"
138+
vpc_id = module.vpc.vpc_id
139+
}
140+
141+
resource "aws_security_group_rule" "rds_sg_rule" {
142+
security_group_id = module.rds-sg.id
143+
from_port = 5432
144+
to_port = 5432
145+
type = "ingress"
146+
protocol = "TCP"
147+
description = "PGSQL ingress for RDS"
148+
source_security_group_id = module.asg-sg.id
149+
}
150+
151+
module "rds" {
152+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/rds?ref=rds"
153+
db_engine = "postgres"
154+
db_instance_type = "db.m5.xlarge"
155+
db_name = "confluence"
156+
db_password = var.db_password
157+
db_storage_size = 20
158+
db_storage_type = "gp2"
159+
db_username = "confluence"
160+
engine_version = "11"
161+
name_prefix = "confluence"
162+
security_group_id = module.rds-sg.id
163+
subnet_ids = module.vpc.private_subnet_ids
164+
}
165+
166+
module "int-alb" {
167+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/alb?ref=alb"
168+
vpc_id = module.vpc.vpc_id
169+
name_prefix = "confluence-int"
170+
subnet_ids = module.vpc.public_subnet_ids
171+
}
172+
173+
module "int_alb_http_port_sg_rule" {
174+
source = "fpco/foundation/aws//modules/single-port-sg"
175+
security_group_id = module.int-alb.security_group_id
176+
cidr_blocks = ["192.168.0.0/16"]
177+
port = 80
178+
description = "HTTP ingress for ALB"
179+
}
180+
181+
module "int_alb_https_port_sg_rule" {
182+
source = "fpco/foundation/aws//modules/single-port-sg"
183+
security_group_id = module.int-alb.security_group_id
184+
cidr_blocks = ["192.168.0.0/16"]
185+
port = 443
186+
description = "HTTPS ingress for ALB"
187+
}
188+
189+
module "int-alb-to-asg" {
190+
source = "fpco/foundation/aws//modules/open-egress-sg"
191+
security_group_id = module.int-alb.security_group_id
192+
}
193+
194+
module "int-forwarder" {
195+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/alb-default-forward?ref=alb"
196+
lb_arn = module.int-alb.lb_arn
197+
lb_port = 443
198+
name_prefix = "confluence-int-https"
199+
protocol = "HTTPS"
200+
service_port = 80
201+
vpc_id = module.vpc.vpc_id
202+
https_cert_arn = aws_acm_certificate_validation.validation.certificate_arn
203+
}
204+
205+
module "int_redirector" {
206+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/alb-redirect?ref=alb"
207+
lb_arn = module.int-alb.lb_arn
208+
http_port = 80
209+
https_port = 443
210+
}
211+
212+
module "ext-alb" {
213+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/alb?ref=alb"
214+
vpc_id = module.vpc.vpc_id
215+
name_prefix = "confluence-ext"
216+
subnet_ids = module.vpc.public_subnet_ids
217+
internal = false
218+
}
219+
220+
module "ext_alb_http_port_sg_rule" {
221+
source = "fpco/foundation/aws//modules/single-port-sg"
222+
security_group_id = module.ext-alb.security_group_id
223+
cidr_blocks = ["0.0.0.0/0"]
224+
port = 80
225+
description = "HTTP ingress for ALB"
226+
}
227+
228+
module "ext_alb_https_port_sg_rule" {
229+
source = "fpco/foundation/aws//modules/single-port-sg"
230+
security_group_id = module.ext-alb.security_group_id
231+
cidr_blocks = ["0.0.0.0/0"]
232+
port = 443
233+
description = "HTTPS ingress for ALB"
234+
}
235+
236+
module "ext-alb-to-asg" {
237+
source = "fpco/foundation/aws//modules/open-egress-sg"
238+
security_group_id = module.ext-alb.security_group_id
239+
}
240+
241+
module "ext-forwarder" {
242+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/alb-default-forward?ref=alb"
243+
lb_arn = module.ext-alb.lb_arn
244+
lb_port = 443
245+
name_prefix = "confluence-ext-https"
246+
protocol = "HTTPS"
247+
service_port = 80
248+
vpc_id = module.vpc.vpc_id
249+
https_cert_arn = aws_acm_certificate_validation.validation.certificate_arn
250+
}
251+
252+
module "ext_redirector" {
253+
source = "git::ssh://[email protected]/fpco/terraform-aws-foundation//modules/alb-redirect?ref=alb"
254+
lb_arn = module.ext-alb.lb_arn
255+
http_port = 80
256+
https_port = 443
257+
}
258+
259+
resource "aws_route53_record" "int" {
260+
zone_id = data.aws_route53_zone.sandbox.zone_id
261+
name = "c-i.${data.aws_route53_zone.sandbox.name}"
262+
type = "A"
263+
alias {
264+
name = module.int-alb.lb_dns_name
265+
zone_id = module.int-alb.lb_zone_id
266+
evaluate_target_health = true
267+
}
268+
}
269+
270+
resource "aws_route53_record" "ext" {
271+
zone_id = data.aws_route53_zone.sandbox.zone_id
272+
name = "c-e.${data.aws_route53_zone.sandbox.name}"
273+
type = "A"
274+
alias {
275+
name = module.ext-alb.lb_dns_name
276+
zone_id = module.ext-alb.lb_zone_id
277+
evaluate_target_health = true
278+
}
279+
}
280+
281+
resource "aws_acm_certificate" "cert" {
282+
domain_name = aws_route53_record.ext.fqdn
283+
subject_alternative_names = [aws_route53_record.int.fqdn]
284+
validation_method = "DNS"
285+
}
286+
287+
resource "aws_route53_record" "cert_validation_ext" {
288+
name = aws_acm_certificate.cert.domain_validation_options.0.resource_record_name
289+
type = aws_acm_certificate.cert.domain_validation_options.0.resource_record_type
290+
zone_id = data.aws_route53_zone.sandbox.id
291+
records = [aws_acm_certificate.cert.domain_validation_options.0.resource_record_value]
292+
ttl = 60
293+
}
294+
295+
resource "aws_route53_record" "cert_validation_int" {
296+
name = aws_acm_certificate.cert.domain_validation_options.1.resource_record_name
297+
type = aws_acm_certificate.cert.domain_validation_options.1.resource_record_type
298+
zone_id = data.aws_route53_zone.sandbox.id
299+
records = [aws_acm_certificate.cert.domain_validation_options.1.resource_record_value]
300+
ttl = 60
301+
}
302+
303+
resource "aws_acm_certificate_validation" "validation" {
304+
certificate_arn = aws_acm_certificate.cert.arn
305+
validation_record_fqdns = [aws_route53_record.cert_validation_ext.fqdn, aws_route53_record.cert_validation_int.fqdn]
306+
}

0 commit comments

Comments
 (0)